aismemory 0.3.0 → 0.5.0

package/dist/key-auth.js

@@ -0,0 +1,179 @@
+/**
+ * Key-based authentication for the aismemory client.
+ *
+ * Phase 1 of the DID-auth ladder: the user generates an Ed25519 keypair on
+ * their device (via `enable-key-auth`), publishes the public key to AIS once,
+ * and from then on signs server-issued challenges with the private key to
+ * obtain owner JWTs. The browser activate flow is needed only at enrollment.
+ *
+ * Threat model:
+ *   - Private key lives at `~/.aismemory/keys/<userDid>.json`, mode 0600.
+ *     Same handling story as an SSH private key without a passphrase.
+ *   - The server NEVER sees the private key — only the public half.
+ *   - Owner JWTs are NOT persisted; they live in memory for the session.
+ *     When the JWT expires (or AIS rotates JWT_SECRET) the client silently
+ *     re-runs challenge/prove. The user notices nothing.
+ */
+import { generateKeyPairSync, createPrivateKey, sign as edSign, } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, readdirSync, chmodSync, } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+// ───────────────────────────────────────────────────────────────────────────
+// Filesystem helpers
+// ───────────────────────────────────────────────────────────────────────────
+/** Default location for key files. Override via `keysDir` arg in tests. */
+function defaultKeysDir() {
+    return join(homedir(), '.aismemory', 'keys');
+}
+function keyFilePath(userDid, keysDir) {
+    return join(keysDir ?? defaultKeysDir(), `${userDid}.json`);
+}
+/** Read a key file. Returns null if the file is absent. Throws on malformed JSON. */
+export function readKeyFile(opts) {
+    const path = keyFilePath(opts.userDid, opts.keysDir);
+    if (!existsSync(path))
+        return null;
+    const raw = readFileSync(path, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1) {
+        throw new Error(`Unsupported key file version: ${parsed.version}. Run \`aismemory enable-key-auth\` to re-enroll.`);
+    }
+    return parsed;
+}
+/**
+ * Discover a single key file in `keysDir` when the caller doesn't know which
+ * userDid to load. Common case: the MCP server boots, sees a single key on
+ * disk, and uses it. Returns null if zero or multiple keys are present.
+ */
+function discoverSingleKeyFile(keysDir) {
+    const dir = keysDir ?? defaultKeysDir();
+    if (!existsSync(dir))
+        return null;
+    const entries = readdirSync(dir).filter((f) => f.endsWith('.json'));
+    if (entries.length !== 1)
+        return null;
+    const path = join(dir, entries[0]);
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    if (parsed.version !== 1)
+        return null;
+    return parsed;
+}
+/**
+ * Generate a fresh Ed25519 keypair, write it to disk, and return the result.
+ * The directory is created with mode 0700 and the key file with mode 0600.
+ *
+ * This is called once per device by the `enable-key-auth` CLI bootstrap.
+ */
+export async function generateAndSaveKeypair(opts) {
+    const dir = opts.keysDir ?? defaultKeysDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+    // Export to JWK form so we have a canonical wire shape AND the raw bytes.
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    const privateJwk = privateKey.export({ format: 'jwk' });
+    const file = {
+        version: 1,
+        userId: opts.userId,
+        userDid: opts.userDid,
+        keyType: 'Ed25519',
+        privateKey: privateJwk.d,
+        publicKey: publicJwk.x,
+        publicKeyJwk: { kty: 'OKP', crv: 'Ed25519', x: publicJwk.x },
+        createdAt: new Date().toISOString(),
+    };
+    const path = keyFilePath(opts.userDid, opts.keysDir);
+    writeFileSync(path, JSON.stringify(file, null, 2));
+    // chmod after write — writeFileSync's mode arg is umasked, so explicit
+    // chmod is the only reliable path to 0600 on POSIX.
+    if (process.platform !== 'win32') {
+        chmodSync(path, 0o600);
+    }
+    return file;
+}
+// ───────────────────────────────────────────────────────────────────────────
+// Crypto: sign the canonical challenge string
+// ───────────────────────────────────────────────────────────────────────────
+/**
+ * Sign the canonical challenge bytes with the user's private key. Returns
+ * the signature as a base64url string ready for the wire.
+ *
+ * Canonical form: `<userDid>\n<nonce>\n<exp>` as UTF-8 bytes. Must match the
+ * server's verification (see did-auth.ts in agent-identity-service).
+ */
+function signChallenge(args) {
+    // Import the raw private key bytes back into a Node KeyObject. The JWK
+    // round-trip is the simplest way to do this without depending on PKCS#8
+    // formatting nuances.
+    const priv = createPrivateKey({
+        key: {
+            kty: 'OKP',
+            crv: 'Ed25519',
+            x: args.publicKeyB64,
+            d: args.privateKeyB64,
+        },
+        format: 'jwk',
+    });
+    const msg = Buffer.from(`${args.userDid}\n${args.nonce}\n${args.exp}`, 'utf8');
+    return edSign(null, msg, priv).toString('base64url');
+}
+/**
+ * Attempt key-based authentication against AIS. Returns null if no usable
+ * key file exists (caller should fall back to device flow). Throws on any
+ * fatal error (bad signature, network failure, server rejection).
+ */
+export async function tryKeyAuth(opts) {
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    // 1. Locate a key file.
+    let keyFile;
+    if (opts.userDid) {
+        keyFile = readKeyFile({ userDid: opts.userDid, keysDir: opts.keysDir });
+    }
+    else {
+        keyFile = discoverSingleKeyFile(opts.keysDir);
+    }
+    if (!keyFile)
+        return null;
+    // 2. Issue a challenge.
+    const challengeRes = await fetchImpl(`${opts.aisUrl}/v1/auth/challenge`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ userDid: keyFile.userDid }),
+    });
+    const challengeBody = (await challengeRes.json());
+    if (!challengeRes.ok || !challengeBody.success || !challengeBody.data) {
+        throw new Error(`key-auth: challenge failed (${challengeRes.status}): ${challengeBody.error?.message ?? challengeBody.error?.code ?? 'unknown'}`);
+    }
+    const { nonce, exp, hmac } = challengeBody.data;
+    // 3. Sign the canonical message.
+    const signature = signChallenge({
+        privateKeyB64: keyFile.privateKey,
+        publicKeyB64: keyFile.publicKey,
+        userDid: keyFile.userDid,
+        nonce,
+        exp,
+    });
+    // 4. Submit the signed proof.
+    const proveRes = await fetchImpl(`${opts.aisUrl}/v1/auth/did-prove`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            userDid: keyFile.userDid,
+            nonce,
+            exp,
+            hmac,
+            signature,
+        }),
+    });
+    const proveBody = (await proveRes.json());
+    if (!proveRes.ok || !proveBody.success || !proveBody.data) {
+        throw new Error(`key-auth: did-prove failed (${proveRes.status}): ${proveBody.error?.message ?? proveBody.error?.code ?? 'unknown'}`);
+    }
+    return {
+        userId: keyFile.userId,
+        userDid: keyFile.userDid,
+        token: proveBody.data.bearerToken,
+        expiresAt: proveBody.data.expiresAt,
+        tokenType: 'owner',
+    };
+}
+//# sourceMappingURL=key-auth.js.map

package/dist/key-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-auth.js","sourceRoot":"","sources":["../src/key-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,IAAI,IAAI,MAAM,GAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAwClC,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,2EAA2E;AAC3E,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,OAAgB;IACpD,OAAO,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,IAA2C;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,OAAO,mDAAmD,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,OAAO,IAAI,cAAc,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;IAClE,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAI5C;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAEjE,0EAA0E;IAC1E,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAqB,CAAC;IAC1E,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAqC,CAAC;IAE5F,MAAM,IAAI,GAAY;QACpB,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,UAAU,CAAC,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC,CAAC;QACtB,YAAY,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE;QAC5D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAMtB;IACC,uEAAuE;IACvE,wEAAwE;IACxE,sBAAsB;IACtB,MAAM,IAAI,GAAc,gBAAgB,CAAC;QACvC,GAAG,EAAE;YACH,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,IAAI,CAAC,YAAY;YACpB,CAAC,EAAE,IAAI,CAAC,aAAa;SACb;QACV,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAgCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAErD,wBAAwB;IACxB,IAAI,OAAuB,CAAC;IAC5B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,wBAAwB;IACxB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,oBAAoB,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAsB,CAAC;IACvE,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,+BAA+B,YAAY,CAAC,MAAM,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,CACjI,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC;IAEhD,iCAAiC;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC;QAC9B,aAAa,EAAE,OAAO,CAAC,UAAU;QACjC,YAAY,EAAE,OAAO,CAAC,SAAS;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK;QACL,GAAG;KACJ,CAAC,CAAC;IAEH,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,oBAAoB,EAAE;QACnE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK;YACL,GAAG;YACH,IAAI;YACJ,SAAS;SACV,CAAC;KACH,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,MAAM,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,CACrH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW;QACjC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS;QACnC,SAAS,EAAE,OAAO;KACnB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aismemory",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Persistent memory for AI agents. MCP server that connects to Agent Identity Service.",
   "type": "module",
   "bin": "dist/index.js",